CLAIMS: 



1. A device for the redundant voltage supply of safety-relevant systems, in 
particular in motor vehicles, having: 

at least one first drive device (1), one second drive device (2) and one 
third drive device (3), each of these drive devices being designed to drive relays in a 
relay unit (4) for switching over voltage supplies of safety- re levant systems (5), 
characterized in that 

the drive devices (1, 2, 3) are connected to a communication channel 

(11), 

the first and second drive devices (1, 2) each have a device for monitoring a 
voltage applied to the safety-relevant systems (5), 

the first drive device (1) can trigger a switching process of the relay unit 
(4) and output a request message (Anf1) to the communication channel (11) if the 
device for monitoring a voltage applied to the safety-relevant systems (5) detects 
that no voltage is applied; 

the second drive device (2) has a device for checking whether the first 
drive device has driven and switched the relay unit (4), and, if the device for 
checking determines that the first drive device has not driven or has switched the 
relay unit, and the device for monitoring a voltage applied to the safety-relevant 
systems (5) detects that no voltage is applied, said second drive device can trigger a 
switching process of the relay unit (4) and, if it is not possible to trigger a switching 
process of the relay unit (4), can output a further request message (Anf2) to the 
communication channel (1 1 ), 

and 

the third drive device (3) can receive from the communication channel 
(11) the request messages (Anf1, Anf2) from the first and second drive devices (1, 2) 
and can trigger a switching process of the relay unit (4) when both request 
messages (Anf1, Anf2) are received. 

2. The device as claimed in claim 1 , characterized in that 

another unit for switching over voltages can also be used in place of the 
relay unit (4) having relays. 

3. The device as claimed in claim 1 or 2, characterized in that 
the communication channel (1 1) is a CAN bus. 
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4. A method for the redundant voltage supply of safety-relevant systems, in 
particular in motor vehicles, characterized by the steps: 

(51) a first drive device (1) monitors via a first line (Sp1) whether a 
voltage can be detected across one or more safety-relevant systems (5); return to 
the start if this is the case; 

(52) if it is determined in step S1 that no voltage is applied to one or more 
safety-relevant systems (5), the first drive device (1) drives a relay unit (4) by means 
of a first control signal (St1) so that a voltage is again applied to the safety-relevant 
system or systems (5); 

(53) the first drive device (1) outputs to a communication channel (11) a 
first request message (Anf1) which states that it is necessary to switch over at least 
one relay of the relay unit (4) in order to supply voltage; 

(54) the second drive device (2) receives the first request message 

(Anfl); 

(55) the second drive device (2) checks whether the first drive device (1) 
has successfully driven/switched over the relay unit (4); return to the start if this is 
the case; 

(56) the second drive device (2) determines via a second line (Sp2) 
whether a voltage is applied to one or more safety-relevant systems (5); return to the 
start in the affirmative; 

(57) check whether it is possible for the second drive unit (2) to 
drive/switch the relay unit (4) in the negative case; 

(58) the second drive device (2) drives/switches the relay unit (4) by 
means of a second control signal (St2) if driving/switching is judged to be possible in 
step S7, then return to the start; 

(59) the second drive device (2) outputs a second request message 
(Anf2) to the communication channel (11) if it is not possible for the second drive 
device (2) to drive/switch the relay unit (4) for whatever reasons, for example due to 
an interruption in the line for the second control signal; 

(510) the third drive device (3) receives the second request message 
(Anf2) from the second drive device (2) together with the first request message 
(Anf1 ) from the first drive device (1 ); 

(511) the third drive device (3) drives/switches the relay unit (4) by means 
of a third control signal (St3); then return to the start. 
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